Important Detection 2026: Remote Service Creation for Lateral Movement (T1021.002, T1569.002)
Detects the creation of new system services using EventID 7045 where the ImagePath points to suspicious temporary directories, administrative shares (ADMIN$), or utilizes randomly generated service names. This pattern is commonly associated with PsExec-style lateral movement and ransomware staging.
Sigma
